+ * Two properties matter here: + *
+ * No longer used, and deliberately so. It injected a {@code "method"} key into every + * {@code payment_details} object with values ({@code credit_card}, {@code bank_wire}, + * {@code digital_wallet}) that disagreed with the {@code payment_type} value emitted alongside + * it. The wire contract carries no type discriminator on {@code payment_details}: the + * variant is expressed by which keys are present, with the constant {@code payment_type} acting + * as the de-facto discriminator. No other SDK in the fleet emitted {@code method}. + * + *
+ * Gson dispatches on the runtime type of each element of a {@code List
+ * There is deliberately no {@code default} case rewriting the status: an unmatched status is
+ * reported as itself. Collapsing 502, 503 and 500 into one substituted 500 with the body
+ * discarded is what used to make retry decisions impossible.
+ */
+ static RiskifiedHttpException buildHttpException(int status, String statusText, String body, Response parsed) {
+ Error error = parsed == null ? null : parsed.getError();
+ String message;
+ if (status == 504) {
+ // Documented by the CBG and Account Secure specs with no content schema.
+ message = "Temporary error, please retry";
+ } else if (error != null && error.getMessage() != null && !error.getMessage().isEmpty()) {
+ message = error.getMessage();
+ } else if (body != null && !body.trim().isEmpty()) {
+ message = body;
+ } else if (statusText != null && !statusText.isEmpty()) {
+ message = statusText;
+ } else {
+ message = "HTTP " + status;
+ }
+ return new RiskifiedHttpException(status, statusText, body, error, message);
+ }
+
+ /**
+ * Best-effort parse of an error body into the common {@code {"error":{"message":...}}} shape.
+ * Returns {@code null} for any of the other six documented shapes, for a bare JSON string, and
+ * for an empty or malformed body. Never throws: the caller already knows the request failed and
+ * the raw body is preserved regardless.
+ */
+ private static Response tryParseCheckoutResponse(String postBody) {
+ try {
+ CheckoutResponse res = new Gson().fromJson(postBody, CheckoutResponse.class);
+ if (res == null) {
+ return null;
+ }
+ res.setOrder(res.getCheckout());
+ return res;
+ } catch (RuntimeException e) {
+ return null;
}
}
@@ -1014,26 +1054,20 @@ private Response postOrder(Object data, String url) throws IOException {
HttpResponse response;
HttpClient client = constructHttpClient();
response = executeClient(client, request);
- String postBody = EntityUtils.toString(response.getEntity());
+ // Explicit UTF-8. Without it EntityUtils falls back to ISO-8859-1 whenever the response
+ // omits a charset parameter, which turns any non-ASCII error message into mojibake --
+ // and this body is now preserved verbatim on the exception, so mangling it here would
+ // corrupt the thing the caller is meant to read. postCheckoutOrder already did this.
+ String postBody = EntityUtils.toString(response.getEntity(), "UTF-8");
int status = response.getStatusLine().getStatusCode();
- Response responseObject = getResponseObject(postBody);
- switch (status) {
- case 200:
- return responseObject;
- case 400:
- throw new HttpResponseException(status, postBody);
- case 401:
- throw new HttpResponseException(status, postBody);
- case 404:
- throw new HttpResponseException(status, postBody);
- case 429:
- throw new HttpResponseException(status, postBody);
- case 504:
- throw new HttpResponseException(status, "Temporary error, please retry");
- default:
- throw new HttpResponseException(500, "Contact Riskified support");
- }
+ String statusText = response.getStatusLine().getReasonPhrase();
+
+ if (status == 200) {
+ return getResponseObject(postBody);
+ }
+ // Same rule as the checkout path: report the status the server sent, keep the body.
+ throw buildHttpException(status, statusText, postBody, getResponseObject(postBody));
}
private Response getResponseObject(String postBody) throws IOException {
diff --git a/riskified-sdk/src/main/java/com/riskified/RiskifiedHttpException.java b/riskified-sdk/src/main/java/com/riskified/RiskifiedHttpException.java
new file mode 100644
index 00000000..284c02b3
--- /dev/null
+++ b/riskified-sdk/src/main/java/com/riskified/RiskifiedHttpException.java
@@ -0,0 +1,78 @@
+package com.riskified;
+
+import com.riskified.models.Error;
+import org.apache.http.client.HttpResponseException;
+
+/**
+ * A non-2xx response from the Riskified API, with the transport facts preserved as structured
+ * fields rather than flattened into a message string.
+ *
+ *
+ * It extends {@link HttpResponseException}, so every existing {@code catch (HttpResponseException)}
+ * keeps working and {@link #getStatusCode()} keeps returning what it always did. What is new is
+ * that the real status now survives: the client used to rewrite every unmatched status to
+ * {@code 500 "Contact Riskified support"} and discard the body, which made a 502, a 503 and a
+ * genuine 500 indistinguishable to a caller trying to decide whether to retry.
+ *
+ *
+ * {@link #getResponseBody()} carries the raw body as a separate field so that logging can redact
+ * it. Response bodies can contain customer PII, and a message string is the one place logging
+ * cannot reach — a defect the reference implementation has
+ * ({@code Riskified.SDK/Utils/HttpUtils.cs:224}) and that this SDK should not deepen.
+ *
+ *
+ * The API returns seven mutually incompatible error body shapes across its six specs
+ * ({@code docs/flows/00-shared-contract.md} section 6). {@link #getError()} is populated only when
+ * the body matched the common {@code {"error": {"message": ...}}} shape; for the other six it is
+ * {@code null} and the body is still available verbatim. It is never a reason to fail.
+ *
+ * @since 6.4.1
+ */
+public class RiskifiedHttpException extends HttpResponseException {
+
+ private static final long serialVersionUID = 1L;
+
+ private final String statusText;
+ private final String responseBody;
+ private final Error error;
+
+ /**
+ * @param statusCode the real HTTP status code, never a substituted one
+ * @param statusText the HTTP reason phrase, may be {@code null}
+ * @param responseBody the raw response body, may be {@code null}
+ * @param error the parsed error object when the body matched the common shape, else
+ * {@code null}
+ * @param message the exception message
+ */
+ public RiskifiedHttpException(int statusCode, String statusText, String responseBody, Error error,
+ String message) {
+ super(statusCode, message);
+ this.statusText = statusText;
+ this.responseBody = responseBody;
+ this.error = error;
+ }
+
+ /**
+ * @return the HTTP reason phrase, or {@code null} if the response carried none
+ */
+ public String getStatusText() {
+ return statusText;
+ }
+
+ /**
+ * @return the raw response body, or {@code null} if the response had none. Attach this to a
+ * structured log field, not to a message string — it can contain customer PII.
+ */
+ public String getResponseBody() {
+ return responseBody;
+ }
+
+ /**
+ * @return the parsed error, or {@code null} when the body did not match the common
+ * {@code {"error": {"message": ...}}} shape. A {@code null} here says nothing about
+ * whether the request failed.
+ */
+ public Error getError() {
+ return error;
+ }
+}
diff --git a/riskified-sdk/src/main/java/com/riskified/SHA256Handler.java b/riskified-sdk/src/main/java/com/riskified/SHA256Handler.java
index 7b75d576..5d00b3fd 100644
--- a/riskified-sdk/src/main/java/com/riskified/SHA256Handler.java
+++ b/riskified-sdk/src/main/java/com/riskified/SHA256Handler.java
@@ -5,6 +5,7 @@
import java.security.InvalidKeyException;
import java.security.Key;
import java.security.NoSuchAlgorithmException;
+import java.nio.charset.StandardCharsets;
import java.util.Formatter;
public class SHA256Handler {
@@ -21,7 +22,10 @@ public synchronized String createSHA256(byte[] data) throws IllegalStateExceptio
}
private Mac createSHA256Key(String authKey) throws RiskifiedError {
- Key sk = new SecretKeySpec(authKey.getBytes(), "HmacSHA256");
+ // UTF-8, never the platform default charset: the default makes the signature depend on
+ // a JVM locale setting. Riskified tokens are hex, so UTF-8 and the reference
+ // implementation's ASCII (Riskified.SDK/Utils/HttpUtils.cs:152) agree byte for byte.
+ Key sk = new SecretKeySpec(authKey.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
Mac mac;
try {
mac = Mac.getInstance(sk.getAlgorithm());
diff --git a/riskified-sdk/src/main/java/com/riskified/adapters/NaiveDateTypeAdapter.java b/riskified-sdk/src/main/java/com/riskified/adapters/NaiveDateTypeAdapter.java
new file mode 100644
index 00000000..38734795
--- /dev/null
+++ b/riskified-sdk/src/main/java/com/riskified/adapters/NaiveDateTypeAdapter.java
@@ -0,0 +1,129 @@
+package com.riskified.adapters;
+
+import com.google.gson.JsonSyntaxException;
+import com.google.gson.TypeAdapter;
+import com.google.gson.stream.JsonReader;
+import com.google.gson.stream.JsonToken;
+import com.google.gson.stream.JsonWriter;
+
+import java.io.IOException;
+import java.text.ParseException;
+import java.text.SimpleDateFormat;
+import java.util.Date;
+import java.util.Locale;
+import java.util.TimeZone;
+
+/**
+ * Gson {@link TypeAdapter} for the naive (offset-free) date fields of the Riskified wire
+ * contract.
+ *
+ *
+ * The contract carries two date formats and the split between them is per field, not per type:
+ *
+ * The reference implementation reaches the same split by accident, through two CLR types
+ * ({@code DateTimeOffset?} vs {@code DateTime?}) and no configured converter. Java has a single
+ * {@link Date} type, so the split has to be declared field by field instead. The authoritative
+ * lists live in the contract corpus at {@code docs/flows/01-model-catalog.md} section 3.
+ *
+ *
+ * Both formats are rendered in UTC. Rendering in the JVM default timezone would make the
+ * same {@link Date} serialize differently on two machines, and the HMAC is computed over the
+ * serialized bytes.
+ *
+ *
+ * On read the adapter is deliberately tolerant: a naive string, an offset-bearing string, a
+ * date-only string, or epoch milliseconds are all accepted, because responses are not guaranteed to
+ * echo the format the SDK sent.
+ *
+ * @since 6.4.1
+ */
+public class NaiveDateTypeAdapter extends TypeAdapter
+ * {@link Locale#US} is passed explicitly: the default locale can select a non-Gregorian
+ * calendar (Thai Buddhist, Japanese imperial), which would render a different year for the same
+ * instant on a differently configured JVM — the same class of machine-dependence as the
+ * timezone.
+ *
+ * @param pattern the {@link SimpleDateFormat} pattern
+ * @return a non-lenient formatter fixed to UTC and to {@link Locale#US}
+ */
+ public static SimpleDateFormat utcFormat(String pattern) {
+ SimpleDateFormat format = new SimpleDateFormat(pattern, Locale.US);
+ format.setTimeZone(TimeZone.getTimeZone("UTC"));
+ format.setLenient(false);
+ return format;
+ }
+
+ @Override
+ public void write(JsonWriter out, Date value) throws IOException {
+ if (value == null) {
+ // Leaves the deferred field name unwritten while serializeNulls is off, so a null date
+ // is omitted exactly as it was before this adapter existed.
+ out.nullValue();
+ return;
+ }
+ out.value(utcFormat(NAIVE_PATTERN).format(value));
+ }
+
+ @Override
+ public Date read(JsonReader in) throws IOException {
+ JsonToken token = in.peek();
+ if (token == JsonToken.NULL) {
+ in.nextNull();
+ return null;
+ }
+ if (token == JsonToken.NUMBER) {
+ return new Date(in.nextLong());
+ }
+ String raw = in.nextString();
+ if (raw == null || raw.trim().isEmpty()) {
+ return null;
+ }
+ return parse(raw.trim());
+ }
+
+ /**
+ * Parses a date written in any of the formats the Riskified API is known to return.
+ *
+ * @param raw the date string, already trimmed
+ * @return the parsed date
+ * @throws JsonSyntaxException if no known format matches
+ */
+ public static Date parse(String raw) {
+ for (String pattern : READ_PATTERNS) {
+ try {
+ return utcFormat(pattern).parse(raw);
+ } catch (ParseException ignored) {
+ // try the next pattern
+ }
+ }
+ throw new JsonSyntaxException("Unparseable date: \"" + raw + "\"");
+ }
+}
diff --git a/riskified-sdk/src/main/java/com/riskified/adapters/PaymentDetailsAdapterFactory.java b/riskified-sdk/src/main/java/com/riskified/adapters/PaymentDetailsAdapterFactory.java
new file mode 100644
index 00000000..d03f8a5e
--- /dev/null
+++ b/riskified-sdk/src/main/java/com/riskified/adapters/PaymentDetailsAdapterFactory.java
@@ -0,0 +1,82 @@
+package com.riskified.adapters;
+
+import com.google.gson.Gson;
+import com.google.gson.JsonParseException;
+import com.google.gson.TypeAdapter;
+import com.google.gson.TypeAdapterFactory;
+import com.google.gson.reflect.TypeToken;
+import com.google.gson.stream.JsonReader;
+import com.google.gson.stream.JsonWriter;
+import com.riskified.models.IPaymentDetails;
+
+import java.io.IOException;
+
+/**
+ * Serializes each element of a {@code payment_details} array as its own runtime type, and emits
+ * no type discriminator.
+ *
+ *
+ * {@code payment_details} carries no discriminator on the wire: the variant is expressed by which
+ * keys are present, with the constant {@code payment_type} acting as the de-facto discriminator
+ * ({@code docs/flows/01-model-catalog.md} section 6). This SDK previously used a
+ * {@code RuntimeTypeAdapterFactory} for the dispatch, which injected a {@code "method"} key with
+ * values that disagreed with the {@code payment_type} emitted alongside it.
+ *
+ *
+ * Why a factory is still needed at all. Gson normally dispatches on an element's runtime type
+ * by itself, via {@code TypeAdapterRuntimeTypeWrapper}. It does not here: {@code BaseOrder} and
+ * {@code DecisionOrder} declare the field as {@code List}, and Gson's
+ * runtime-type promotion fires only when the declared element type is a {@code Class} — a
+ * {@code WildcardType} is left alone. Without this factory the reflective adapter for the bare
+ * interface runs instead and every element serializes as {@code {}}: total, silent loss of the
+ * payment details. Dropping the old factory without replacing it is therefore not a safe no-op.
+ *
+ *
+ * Only the interface itself is matched, so the delegate lookup for the concrete class cannot re-enter
+ * this factory.
+ *
+ * @since 6.4.1
+ */
+public class PaymentDetailsAdapterFactory implements TypeAdapterFactory {
+
+ @Override
+ @SuppressWarnings("unchecked")
+ public
+ * The contract carries two date formats. 25 fields are offset-bearing
+ * ({@code 2026-08-13T10:00:00+00:00}) and 13 are naive, with no offset at all
+ * ({@code 2026-08-13T10:00:00}). The reference implementation reaches the split through two CLR
+ * types and no configured converter, so the split follows no principle and has to be reproduced
+ * field by field. Both lists are in {@code docs/flows/01-model-catalog.md} section 3.
+ *
+ *
+ * Java has a single {@link Date}, so a single registered type adapter cannot express the split. The
+ * 13 naive fields carry {@code @JsonAdapter(NaiveDateTypeAdapter.class)}, which Gson gives
+ * precedence over the globally registered adapter; everything else takes the offset format.
+ */
+public class DateSplitTest {
+
+ /** 1970-01-01T00:00:00Z plus 10h — a fixed instant, so the expected strings are literals. */
+ private static final Date FIXED_INSTANT = new Date(36000000L);
+ private static final String EXPECTED_OFFSET_RENDERING = "1970-01-01T10:00:00+00:00";
+ private static final String EXPECTED_NAIVE_RENDERING = "1970-01-01T10:00:00";
+
+ private TimeZone originalTimeZone;
+
+ @Before
+ public void setUp() {
+ originalTimeZone = TimeZone.getDefault();
+ }
+
+ @After
+ public void tearDown() {
+ TimeZone.setDefault(originalTimeZone);
+ }
+
+ /**
+ * One offset-bearing field and one naive field in the same payload — the case the fleet report
+ * asks for as the first golden fixture.
+ */
+ @Test
+ public void testOneOffsetFieldAndOneNaiveFieldInTheSamePayload() {
+ Order inputOrder = new Order();
+ inputOrder.setId("ORDER-1");
+ inputOrder.setCreatedAt(FIXED_INSTANT);
+ RideLineItem inputRide = new RideLineItem(42.5, 1, "Airport transfer", FIXED_INSTANT, 0, 0);
+ List
+ * Two defects are covered. The client used to rewrite every unmatched status to
+ * {@code 500 "Contact Riskified support"} and throw the body away, so a 503, a 502 and a genuine 500
+ * were indistinguishable to a caller deciding whether to retry. And the checkout path read
+ * {@code responseObject.getError().getMessage()} before establishing that the body had parsed as
+ * that shape at all, so any of the other six documented error shapes
+ * ({@code docs/flows/00-shared-contract.md} section 6) produced a {@link NullPointerException} in
+ * place of the HTTP error.
+ */
+public class RiskifiedClientErrorTest {
+
+ /** Parses an error body the way the checkout path does: best effort, never throwing. */
+ private static Response parseCheckoutBody(String body) {
+ try {
+ CheckoutResponse parsed = new Gson().fromJson(body, CheckoutResponse.class);
+ if (parsed == null) {
+ return null;
+ }
+ parsed.setOrder(parsed.getCheckout());
+ return parsed;
+ } catch (RuntimeException e) {
+ return null;
+ }
+ }
+
+ @Test
+ public void testUnmatchedStatusKeepsItsOwnStatusCode() {
+ RiskifiedHttpException actual503 =
+ RiskifiedClient.buildHttpException(503, "Service Unavailable", "upstream down", null);
+ RiskifiedHttpException actual502 =
+ RiskifiedClient.buildHttpException(502, "Bad Gateway", "bad gateway", null);
+ RiskifiedHttpException actual500 =
+ RiskifiedClient.buildHttpException(500, "Internal Server Error", "boom", null);
+
+ assertEquals(503, actual503.getStatusCode());
+ assertEquals(502, actual502.getStatusCode());
+ assertEquals(500, actual500.getStatusCode());
+ assertEquals("Service Unavailable", actual503.getStatusText());
+ }
+
+ @Test
+ public void testUnmatchedStatusKeepsTheResponseBody() {
+ String inputBody = "
+ * The fallback in {@code EntityUtils.toString(entity)} is subtler than "always ISO-8859-1": for
+ * {@code application/json} with no charset parameter, httpclient 4.5.13 resolves UTF-8 from
+ * {@code ContentType.APPLICATION_JSON}'s registered default, so the happy path was never broken.
+ * It falls back to ISO-8859-1 when the mime type's registered default is ISO-8859-1
+ * ({@code text/html}, {@code text/plain}) or when there is no {@code Content-Type} header
+ * at all — which is precisely the 502/503-from-a-proxy and bare-string-OTP-error case that the
+ * unmatched-status work is about. Passing {@code "UTF-8"} explicitly makes the read independent
+ * of what the server chose to label the body.
+ */
+ @Test
+ public void testNonAsciiErrorBodyIsReadAsUtf8RegardlessOfContentType() throws Exception {
+ String inputMessage = "Requête invalide — coût 12€";
+ byte[] inputBytes = inputMessage.getBytes(StandardCharsets.UTF_8);
+ // A proxy error page, and a body with no Content-Type at all.
+ ByteArrayEntity inputHtmlEntity = new ByteArrayEntity(inputBytes, ContentType.create("text/html"));
+ ByteArrayEntity inputUntypedEntity = new ByteArrayEntity(inputBytes);
+
+ assertEquals(inputMessage, EntityUtils.toString(inputHtmlEntity, "UTF-8"));
+ assertEquals(inputMessage, EntityUtils.toString(inputUntypedEntity, "UTF-8"));
+ // Guards the test: without the explicit charset these two are mojibake, which is the bug.
+ assertNotEquals(inputMessage, EntityUtils.toString(new ByteArrayEntity(inputBytes,
+ ContentType.create("text/html"))));
+ assertNotEquals(inputMessage, EntityUtils.toString(new ByteArrayEntity(inputBytes)));
+ }
+
+ /** The non-ASCII body survives onto the exception verbatim, in both the body and the message. */
+ @Test
+ public void testNonAsciiErrorBodyIsPreservedOnTheException() {
+ String inputBody = "{\"error\":{\"message\":\"coût invalide 12€\"}}";
+
+ RiskifiedHttpException actualException =
+ RiskifiedClient.buildHttpException(400, "Bad Request", inputBody, parseCheckoutBody(inputBody));
+
+ assertEquals(inputBody, actualException.getResponseBody());
+ assertNotNull(actualException.getError());
+ assertEquals("coût invalide 12€", actualException.getError().getMessage());
+ }
+
+ /** 504 is documented with no content schema, so its message stays the fixed retry hint. */
+ @Test
+ public void test504KeepsItsDocumentedRetryMessage() {
+ RiskifiedHttpException actualException =
+ RiskifiedClient.buildHttpException(504, "Gateway Timeout", "", null);
+
+ assertEquals(504, actualException.getStatusCode());
+ assertEquals("Temporary error, please retry", actualException.getReasonPhrase());
+ }
+}
diff --git a/riskified-sdk/src/test/java/com/riskified/SHA256HandlerTest.java b/riskified-sdk/src/test/java/com/riskified/SHA256HandlerTest.java
new file mode 100644
index 00000000..5948f56d
--- /dev/null
+++ b/riskified-sdk/src/test/java/com/riskified/SHA256HandlerTest.java
@@ -0,0 +1,90 @@
+package com.riskified;
+
+import org.junit.Test;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+import java.nio.charset.StandardCharsets;
+import java.util.Locale;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotEquals;
+
+/**
+ * HMAC regression tests.
+ *
+ *
+ * The signature is a function of the request body and the auth token alone — no timestamp, no
+ * nonce, no method, no path, no headers — and it is lowercase hex. See
+ * {@code docs/flows/00-shared-contract.md} section 1.
+ */
+public class SHA256HandlerTest {
+
+ /** {@code docs/flows/00-shared-contract.md} section 1, "Reference test vector". */
+ private static final String REFERENCE_TOKEN = "test_token";
+ private static final String REFERENCE_BODY = "{\"order\":{\"id\":\"TEST-1\"}}";
+ private static final String REFERENCE_HMAC =
+ "b07f97d1466dfe33f74c2c006e16cc3d17d97c7f337a96eaaaff35ce20a83131";
+
+ /**
+ * The corpus reference vector. A match proves the key encoding, the message encoding, the hex
+ * casing and the body-only rule all at once.
+ */
+ @Test
+ public void testReferenceVectorReproduces() throws RiskifiedError {
+ SHA256Handler inputHandler = new SHA256Handler(REFERENCE_TOKEN);
+
+ String actualHmac = inputHandler.createSHA256(REFERENCE_BODY.getBytes(StandardCharsets.UTF_8));
+
+ assertEquals(REFERENCE_HMAC, actualHmac);
+ }
+
+ /**
+ * The key is encoded as UTF-8, not with the platform default charset.
+ *
+ *
+ * For the hex tokens Riskified issues this changes nothing — that is exactly why the old
+ * {@code authKey.getBytes()} went unnoticed. The point of pinning it is that the signature must
+ * not depend on a JVM locale setting, so this asserts the encoding directly for a token whose
+ * bytes differ between charsets.
+ */
+ @Test
+ public void testKeyIsEncodedAsUtf8NotThePlatformDefault() throws Exception {
+ String inputNonAsciiToken = "t\u00f6k\u00e9n-\u00e9\u00e0";
+ SHA256Handler inputHandler = new SHA256Handler(inputNonAsciiToken);
+
+ String actualHmac = inputHandler.createSHA256(REFERENCE_BODY.getBytes(StandardCharsets.UTF_8));
+ String expectedUtf8KeyHmac = hmacWithKeyBytes(inputNonAsciiToken.getBytes(StandardCharsets.UTF_8));
+ String latin1KeyHmac = hmacWithKeyBytes(inputNonAsciiToken.getBytes(StandardCharsets.ISO_8859_1));
+
+ assertEquals(expectedUtf8KeyHmac, actualHmac);
+ // Guards the test itself: if these two agreed, the assertion above would prove nothing.
+ assertNotEquals(expectedUtf8KeyHmac, latin1KeyHmac);
+ assertEquals(64, actualHmac.length());
+ assertEquals(actualHmac.toLowerCase(Locale.US), actualHmac);
+ }
+
+ /** An independent HMAC-SHA256 implementation, so the assertions above are not self-referential. */
+ private static String hmacWithKeyBytes(byte[] keyBytes) throws Exception {
+ Mac mac = Mac.getInstance("HmacSHA256");
+ mac.init(new SecretKeySpec(keyBytes, "HmacSHA256"));
+ byte[] digest = mac.doFinal(REFERENCE_BODY.getBytes(StandardCharsets.UTF_8));
+ StringBuilder hex = new StringBuilder(digest.length * 2);
+ for (byte b : digest) {
+ hex.append(String.format(Locale.US, "%02x", b));
+ }
+ return hex.toString();
+ }
+
+ /** A trailing newline changes the digest — the byte-identity rule, demonstrated. */
+ @Test
+ public void testTrailingNewlineChangesTheDigest() throws RiskifiedError {
+ SHA256Handler inputHandler = new SHA256Handler(REFERENCE_TOKEN);
+
+ String actualHmac =
+ inputHandler.createSHA256((REFERENCE_BODY + "\n").getBytes(StandardCharsets.UTF_8));
+
+ assertEquals(64, actualHmac.length());
+ assertNotEquals(REFERENCE_HMAC, actualHmac);
+ }
+}
diff --git a/riskified-sdk/src/test/java/com/riskified/models/KycDetailsTest.java b/riskified-sdk/src/test/java/com/riskified/models/KycDetailsTest.java
new file mode 100644
index 00000000..a9833813
--- /dev/null
+++ b/riskified-sdk/src/test/java/com/riskified/models/KycDetailsTest.java
@@ -0,0 +1,86 @@
+package com.riskified.models;
+
+import com.riskified.JSONFormater;
+import org.junit.Test;
+
+import java.util.Arrays;
+import java.util.Date;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * Wire-name regression tests for {@link KycDetails}.
+ *
+ *
+ * The Java field is named {@code updateAt}, which {@code LOWER_CASE_WITH_UNDERSCORES} derives as
+ * {@code update_at}. The contract key is {@code updated_at} ({@code KycDetails.cs:18}), so the
+ * derived name was a key the API ignores and KYC update timestamps were silently not arriving.
+ * Derived names are only as good as the field they are derived from.
+ */
+public class KycDetailsTest {
+
+ @Test
+ public void testUpdatedAtUsesTheContractWireName() {
+ KycDetails inputDetails = new KycDetails();
+ inputDetails.setUpdateAt(new Date(36000000L));
+
+ String actualJson = JSONFormater.toJson(inputDetails);
+
+ assertTrue("expected the contract key updated_at, got: " + actualJson,
+ actualJson.contains("\"updated_at\":\"1970-01-01T10:00:00+00:00\""));
+ assertFalse("update_at is the derived name, not the contract key: " + actualJson,
+ actualJson.contains("\"update_at\""));
+ }
+
+ /** {@code updated_at} is one of the 25 offset-bearing fields, not one of the 13 naive ones. */
+ @Test
+ public void testUpdatedAtIsOffsetBearing() {
+ KycDetails inputDetails = new KycDetails();
+ inputDetails.setUpdateAt(new Date(36000000L));
+
+ String actualJson = JSONFormater.toJson(inputDetails);
+
+ assertFalse(actualJson, actualJson.contains("\"updated_at\":\"1970-01-01T10:00:00\""));
+ }
+
+ /** The remaining three keys derive correctly; locked so they cannot drift. */
+ @Test
+ public void testRemainingFieldsUseTheirContractWireNames() {
+ KycDetails inputDetails = new KycDetails();
+ inputDetails.setVendorName("Acme KYC");
+ inputDetails.setKycVerified(true);
+ inputDetails.setKycType("full");
+
+ String actualJson = JSONFormater.toJson(inputDetails);
+
+ for (String expectedWireName : Arrays.asList("vendor_name", "kyc_verified", "kyc_type")) {
+ assertTrue("missing wire key " + expectedWireName + " in " + actualJson,
+ actualJson.contains("\"" + expectedWireName + "\""));
+ }
+ }
+
+ /** A customer carrying KYC details serializes the corrected key through the nested path too. */
+ @Test
+ public void testUpdatedAtSurvivesNestingUnderCustomer() {
+ KycDetails inputDetails = new KycDetails();
+ inputDetails.setUpdateAt(new Date(36000000L));
+ Customer inputCustomer = new Customer("a@b.com", "Ada", "Lovelace");
+ inputCustomer.setKycDetails(Arrays.asList(inputDetails));
+
+ String actualJson = JSONFormater.toJson(inputCustomer);
+
+ assertTrue(actualJson, actualJson.contains("\"kyc_details\""));
+ assertTrue(actualJson, actualJson.contains("\"updated_at\""));
+ assertFalse(actualJson, actualJson.contains("\"update_at\""));
+ }
+
+ /** Unset fields stay absent — the always-emitted-defaults boundary is unchanged. */
+ @Test
+ public void testDefaultKycDetailsSerializesEmpty() {
+ String actualJson = JSONFormater.toJson(new KycDetails());
+
+ assertEquals("{}", actualJson);
+ }
+}
diff --git a/riskified-sdk/src/test/java/com/riskified/models/PaymentDetailsTest.java b/riskified-sdk/src/test/java/com/riskified/models/PaymentDetailsTest.java
index e05253ff..aa44fe05 100644
--- a/riskified-sdk/src/test/java/com/riskified/models/PaymentDetailsTest.java
+++ b/riskified-sdk/src/test/java/com/riskified/models/PaymentDetailsTest.java
@@ -162,19 +162,72 @@ public void testWalletValidateRejectsBadAcquirerRegion() throws FieldBadFormatEx
wallet.validate(Validation.ALL);
}
+ /**
+ * {@code payment_details} carries no type discriminator on the wire.
+ *
+ *
+ * The variant is expressed by which keys are present, with the constant {@code payment_type}
+ * acting as the de-facto discriminator — see {@code docs/flows/01-model-catalog.md} section 6.
+ * This SDK used to register a {@code RuntimeTypeAdapterFactory} that injected a {@code "method"}
+ * key whose values ({@code credit_card}, {@code bank_wire}, {@code digital_wallet}) disagreed
+ * with the {@code payment_type} emitted right next to it. No other SDK in the fleet sent it.
+ * Unrecognised keys are dropped rather than rejected, which is why it went unnoticed.
+ */
@Test
- public void testWalletSerializesWithMethodDiscriminator() {
- Gson polymorphicGson = new GsonBuilder()
- .setFieldNamingPolicy(FieldNamingPolicy.LOWER_CASE_WITH_UNDERSCORES)
- .registerTypeAdapterFactory(JSONFormater.paymentDetailsSerializer())
- .create();
+ public void testPaymentDetailsCarryNoMethodDiscriminator() {
+ List
+ * {@code getReceived()} returns a primitive {@code int} from a boxed {@link Integer} field, so
+ * unboxing raised a {@link NullPointerException} on every response that omits {@code received} —
+ * which is every error response. The primitive return type is kept, so existing callers still
+ * compile; absence is now reachable through {@code getReceivedOrNull()}.
+ */
+public class ResponseTest {
+
+ private Gson gson;
+
+ @Before
+ public void setUp() {
+ gson = new GsonBuilder()
+ .setFieldNamingPolicy(FieldNamingPolicy.LOWER_CASE_WITH_UNDERSCORES)
+ .create();
+ }
+
+ @Test
+ public void testGetReceivedDoesNotThrowWhenTheFieldIsAbsent() {
+ Response inputResponse = gson.fromJson("{\"decision\":\"approve\"}", Response.class);
+
+ int actualReceived = inputResponse.getReceived();
+
+ assertEquals(0, actualReceived);
+ }
+
+ @Test
+ public void testGetReceivedOrNullDistinguishesAbsentFromZero() {
+ Response inputAbsent = gson.fromJson("{\"decision\":\"approve\"}", Response.class);
+ Response inputZero = gson.fromJson("{\"received\":0}", Response.class);
+
+ assertNull(inputAbsent.getReceivedOrNull());
+ assertEquals(Integer.valueOf(0), inputZero.getReceivedOrNull());
+ }
+
+ @Test
+ public void testGetReceivedReturnsThePresentValue() {
+ Response inputResponse = gson.fromJson("{\"received\":3}", Response.class);
+
+ assertEquals(3, inputResponse.getReceived());
+ assertEquals(Integer.valueOf(3), inputResponse.getReceivedOrNull());
+ }
+
+ /** An error-shaped body has no {@code received}; reading it must not throw. */
+ @Test
+ public void testErrorShapedBodyIsReadableWithoutThrowing() {
+ Response inputResponse =
+ gson.fromJson("{\"error\":{\"message\":\"order id is missing\"}}", Response.class);
+
+ assertEquals(0, inputResponse.getReceived());
+ assertNull(inputResponse.getReceivedOrNull());
+ assertEquals("order id is missing", inputResponse.getError().getMessage());
+ }
+
+ /** The copy constructor preserves absence rather than turning a missing field into 0. */
+ @Test
+ public void testCheckoutCopyConstructorPreservesAbsentReceived() {
+ CheckoutResponse inputCheckout =
+ gson.fromJson("{\"checkout\":{\"id\":\"C-1\"}}", CheckoutResponse.class);
+
+ Response actualResponse = new Response(inputCheckout);
+
+ assertNull(actualResponse.getReceivedOrNull());
+ assertEquals(0, actualResponse.getReceived());
+ }
+}
diff --git a/riskified-sdk/src/test/java/com/riskified/models/RideLineItemTest.java b/riskified-sdk/src/test/java/com/riskified/models/RideLineItemTest.java
new file mode 100644
index 00000000..d9002670
--- /dev/null
+++ b/riskified-sdk/src/test/java/com/riskified/models/RideLineItemTest.java
@@ -0,0 +1,117 @@
+package com.riskified.models;
+
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import com.riskified.JSONFormater;
+import org.junit.Test;
+
+import java.util.Arrays;
+import java.util.Date;
+import java.util.List;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * Wire-name regression tests for {@link RideLineItem}.
+ *
+ *
+ * Java derives wire names from field names via
+ * {@code FieldNamingPolicy.LOWER_CASE_WITH_UNDERSCORES}, so a field whose Java name does not
+ * snake-case to the contract's key diverges silently. There is no error, no warning, and no
+ * response difference — the data simply stops arriving.
+ */
+public class RideLineItemTest {
+
+ private static RideLineItem fullyPopulatedRideLineItem() {
+ RideLineItem inputItem = new RideLineItem(42.5, 1, "Airport transfer", new Date(0L), 0, 0);
+ inputItem.setPickupLatitude(32.0853f);
+ inputItem.setPickupLongitude(34.7818f);
+ inputItem.setPickupAddress(
+ new Address("Ada", "Lovelace", "1 Rothschild Blvd", "Tel Aviv", "+972500000000", "IL"));
+ inputItem.setDropoffDate(new Date(3600000L));
+ inputItem.setDropoffLatitude(31.7683f);
+ inputItem.setDropoffLongitude(35.2137f);
+ inputItem.setDropoffAddress(
+ new Address("Ada", "Lovelace", "1 Jaffa St", "Jerusalem", "+972500000000", "IL"));
+ inputItem.setTransportMethod("car");
+ inputItem.setPriceBy("distance");
+ inputItem.setVehicleClass("business");
+ inputItem.setCarrierName("Acme Rides");
+ inputItem.setDriverId("driver-1");
+ inputItem.setTariff("flat");
+ inputItem.setNoteToDriver("Second gate");
+ inputItem.setMeetNGreet("yes");
+ inputItem.setCancellationPolicy("free");
+ inputItem.setAuthorizedPayments(42.5f);
+ return inputItem;
+ }
+
+ /**
+ * The contract wire name for the dropoff latitude is {@code dropoff_latitude}.
+ *
+ *
+ * Both OpenAPI specs declare that spelling, with a description and an example. The reference C#
+ * SDK sends a transposed {@code dropoff_latitiude}
+ * ({@code OrderElements/RideTicketLineItem.cs:100}); that is a defect in the C# SDK, not the
+ * contract, and this SDK must not copy it. Guarded in both directions, because an earlier
+ * revision of this branch pinned the transposition deliberately.
+ */
+ @Test
+ public void testDropoffLatitudeUsesTheContractWireName() {
+ RideLineItem inputItem = fullyPopulatedRideLineItem();
+
+ String actualJson = JSONFormater.toJson(inputItem);
+
+ assertTrue("expected the contract wire name dropoff_latitude, got: " + actualJson,
+ actualJson.contains("\"dropoff_latitude\":31.7683"));
+ assertFalse("dropoff_latitiude is the C# SDK's transposition and must not ship: "
+ + actualJson, actualJson.contains("\"dropoff_latitiude\""));
+ }
+
+ /**
+ * Locks the whole derived wire-name map for this class, so a renamed or newly added field
+ * cannot drift without a failing test. Names come from
+ * {@code docs/flows/01-model-catalog.md} section 8, {@code OrderElements/RideTicketLineItem.cs}.
+ */
+ @Test
+ public void testEveryRideFieldUsesItsContractWireName() {
+ List
+ *
+ *
+ *